--- title: 6 AppSec CTOs Debate Open Source Supply Chain Security... description: Socket CTO Ahmad Nassri joined five other AppSec leaders on The Secure Disclosure podcast to discuss open source supply chain security at Black Hat. Key themes... canonical: https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat | daily.dev og:description: Socket CTO Ahmad Nassri joined five other AppSec leaders on The Secure Disclosure podcast to discuss open source supply chain security at Black Hat. Key themes... og:url: https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi og:image: https://api.daily.dev/og/posts/hb33GxjOi.png og:image:alt: 6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat **[Socket](https://daily.dev/sources/socketdev)** · 2 min read · 1 upvotes · 0 comments ## Summary Socket CTO Ahmad Nassri joined five other AppSec leaders on The Secure Disclosure podcast to discuss open source supply chain security at Black Hat. Key themes included the confusion between vulnerability management (CVEs) and active malicious intent, state-sponsored groups like North Korea's DPRK using AI agents to automate credential theft from developer laptops and GitHub Actions pipelines, and structural limitations in registries like npm that prevent disabling risky features like lifecycle scripts without breaking the ecosystem. The panel concluded that defending open source requires industry-wide collaboration between registries, maintainers, enterprise teams, and security vendors rather than siloed efforts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between a CVE vulnerability and active supply chain malware? A CVE describes a known flaw in code that could be exploited, while active malware means threat actors are already poisoning dependency trees, hijacking maintainer credentials, or executing malicious payloads during package installation. Treating active malware as a routine patch management issue fails because attackers aren't waiting to exploit disclosed bugs, they're actively compromising the install process itself. _daily.dev helps security teams stay current on distinctions like malware versus CVEs shaping supply chain defense._ ### Why can't npm just disable lifecycle scripts to stop supply chain attacks? Package registries like npm face deep legacy dependencies, and disabling features such as lifecycle scripts would break massive portions of the open source ecosystem that rely on them. Because of this structural limitation, pre-publication registry scanning only offers a narrow line of defense, and effective protection instead requires visibility across the full execution graph from developer workstations into CI/CD pipelines. _Teams weighing registry-level defenses against ecosystem breakage can track this debate on daily.dev._ ### How are state-sponsored groups like North Korea's DPRK attacking software supply chains? DPRK-linked groups have turned upstream open source compromises into a high-margin business model, using AI agents to automate spear-phishing and script generation. They target developer laptops and GitHub Actions pipelines to steal credentials and pivot directly into production systems, rather than relying solely on traditional vulnerability exploitation. _daily.dev keeps engineers tracking state-sponsored CI/CD and credential-theft tactics as they evolve._ ## Similar posts on daily.dev - [Defending Your Software Supply Chain: What Every Engineering Team Should Do Now](https://daily.dev/posts/defending-your-software-supply-chain-what-every-engineering-team-should-do-now-vrwosxpnq) · Docker · 1 upvotes · 0 comments - [The Hidden Vulnerability of The Open Source Software Supply Chain: The Underlying Infrastructure](https://daily.dev/posts/the-hidden-vulnerability-of-the-open-source-software-supply-chain-the-underlying-infrastructure-xo6dy3wmx) · InfoQ · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#cicd](https://daily.dev/tags/cicd), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat","url":"https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi"},"datePublished":"2026-09-01T00:00:33.918Z","dateModified":"2026-09-01T00:48:11.360Z","description":"Socket CTO Ahmad Nassri joined five other AppSec leaders on The Secure Disclosure podcast to discuss open source supply chain security at Black Hat. Key themes...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fcd29f292c431b1499ba4d4665bd19a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8fcd29f292c431b1499ba4d4665bd19a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,cicd,malware,npm","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/6-appsec-ctos-debate-open-source-supply-chain-security-at-black-hat-hb33gxjoi#faq","mainEntity":[{"@type":"Question","name":"What is the difference between a CVE vulnerability and active supply chain malware?","acceptedAnswer":{"@type":"Answer","text":"A CVE describes a known flaw in code that could be exploited, while active malware means threat actors are already poisoning dependency trees, hijacking maintainer credentials, or executing malicious payloads during package installation. Treating active malware as a routine patch management issue fails because attackers aren't waiting to exploit disclosed bugs, they're actively compromising the install process itself. daily.dev helps security teams stay current on distinctions like malware versus CVEs shaping supply chain defense."}},{"@type":"Question","name":"Why can't npm just disable lifecycle scripts to stop supply chain attacks?","acceptedAnswer":{"@type":"Answer","text":"Package registries like npm face deep legacy dependencies, and disabling features such as lifecycle scripts would break massive portions of the open source ecosystem that rely on them. Because of this structural limitation, pre-publication registry scanning only offers a narrow line of defense, and effective protection instead requires visibility across the full execution graph from developer workstations into CI/CD pipelines. Teams weighing registry-level defenses against ecosystem breakage can track this debate on daily.dev."}},{"@type":"Question","name":"How are state-sponsored groups like North Korea's DPRK attacking software supply chains?","acceptedAnswer":{"@type":"Answer","text":"DPRK-linked groups have turned upstream open source compromises into a high-margin business model, using AI agents to automate spear-phishing and script generation. They target developer laptops and GitHub Actions pipelines to steal credentials and pivot directly into production systems, rather than relying solely on traditional vulnerability exploitation. daily.dev keeps engineers tracking state-sponsored CI/CD and credential-theft tactics as they evolve."}}]} ```